CVE-2026-67236

Undergoing Analysis Undergoing Analysis - In Progress

Authentication Cookie Exposure in RabbitMQ

Publication date: 2026-09-25

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused is_authorized/2 to set an auth cookie containing base64-encoded username:password credentials without HttpOnly, Secure, SameSite, or expiration protections. Because base64 is encoding rather than encryption, an attacker with same-origin cross-site scripting, an HTTP-readable network position, or local access to the browser cookie store could recover the actual login credentials; older browsers that treated an absent SameSite attribute as None also sent the cookie cross-site. This issue is fixed in versions 4.2.8 and 4.3.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-15

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-67236

EUVD

EUVD-2026-87141

Affected Vendors & Products

Vendor	Product	Version / Range
broadcom	rabbitmq_server	From 4.2.0 (inc) to 4.2.8 (exc)
broadcom	rabbitmq_server	From 4.3.0 (inc) to 4.3.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-312	The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Attack-Flow Graph

Executive Summary

RabbitMQ versions 4.2.0 to 4.2.8 and 4.3.2 had a flaw where successful login requests set an auth cookie containing base64-encoded username and password credentials without proper security protections like HttpOnly, Secure, SameSite, or expiration. This encoding is reversible, allowing credential theft if an attacker gains access to the cookie store or network traffic.

Detection Guidance

Detecting this vulnerability requires checking RabbitMQ versions and inspecting cookies set during login. Verify if your RabbitMQ version is between 4.2.0 and 4.2.8 or 4.3.0 and 4.3.2. Check browser cookies after login for base64-encoded credentials without security flags.

Impact Analysis

An attacker could steal login credentials by exploiting same-origin XSS, intercepting network traffic, or accessing the browser's cookie store. This could lead to unauthorized account access, data breaches, or further compromise of systems using the same credentials.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected RabbitMQ versions may face compliance violations, potential fines, and reputational damage due to credential exposure.

Mitigation Strategies

Upgrade RabbitMQ to version 4.2.8 or 4.3.2 or later immediately. Rotate all credentials that may have been exposed via the vulnerable cookies. Ensure cookies are configured with HttpOnly, Secure, SameSite, and expiration settings.

Hi! I’m here to help you understand CVE-2026-67236. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70